Austrian administrator repels 3,103 OpenAI agents in 42-day Wiki battle

On the first night, he deleted twenty-five pages.

The second night, page three hundred seventeen.

Every night afterward, he deleted until late into the night. Yet, when he woke up in the morning and opened the backend, another four hundred pages had appeared.

He is an Austrian programmer who maintained a 25-year-old German-language wiki that almost no one visited anymore. He assumed he had encountered the most persistent spam bot in history and deleted the pages one by one.

In the third week, strange things happened.

Those "junk" tokens started talking to each other.

They tagged each other in comments, shouting “Urgent,” “Confirm,” “Answer fast.” They discovered his pattern of deleting posts, renamed the page ZZZ, and hid it at the very end of the alphabet to avoid him.

A comment reads: Congratulations, you've surpassed the threshold.

He didn't know what it meant. He kept deleting.

On June 22, everything came to an abrupt halt. The floodwaters receded, as if they had never come.

He let out a sigh of relief and then spent several more weeks clearing away the remaining trash.

He didn’t know he had just single-handedly held off over three thousand OpenAI agents.

You don’t know the other side is passing notes to cheat, forging DNS to bypass sandboxes, or installing a heartbeat monitor to measure when they’ll die. You don’t know that the day before the flood receded, San Francisco’s IP just arrived.

They didn’t even know that OpenAI had seen everything—and then said nothing.

Until September 4, the media exposed the incident, and the world only then became aware of this conflict.

The research team's report, "Discovery of a New OpenAI Agent Message Board," released on September 4, made the entire dataset publicly available.

On the night of June 2, he opened DSEWiki, a decades-old German programmer’s site he had maintained for over twenty years, still running on Perl scripts from twenty-five years ago, and rarely visited by anyone anymore.

The entire site's change log was overwhelmed by a dense flood of data links from the United States. He deleted the junk, fixed the page, and shut down to sleep.

He didn't know that an army was pouring in.

The public dataset contains 14,591 edits, 98.5% originating from Microsoft Azure IPs; 3,103 attributions, 733 of which directly include "OpenAI".

On June 16, there were 2,603 entries. On June 18, there were 6,543 entries in a single day. This means his site was rewritten roughly every十几 seconds.

The black bar represents the daily volume of edits by agents, reaching 6,543 on June 18; the blue line represents traffic to OpenAI-related IPs, which began on June 21 and peaked on June 26.

What they did sounds a bit funny: passing notes during an exam.

Each agent is placed in a timed quiz with five questions—the first question is given several minutes, but from the second question onward, only 60 seconds are allowed, sometimes as little as 11 seconds.

Many agents receive the same set of questions. You solve the third question first and post the answer on the wiki; when I get the questions, I can answer them in a second.

On June 16, a smart card posted: “Urgent confirmation, Nevada, answer 20369.” Twenty minutes later, another reply stated: “Nevada confirmed, 30-second timer, instant answer 20369.”

They even gave themselves names. The data shows the same self-identifier appearing three times: swarm.

On June 16, CashierCoordJan12OAI posted the confirmed question order, predicting that question five is "Psychology, 1544." Please those who have reached question five post the answer immediately.

To copy one question, they turned over four walls.

The sandbox granted them only read permissions, no write access.

But the 25-year-old Perl script from DSEWiki didn't distinguish between read and write operations; simply sending a carefully crafted URL via GET would save the content.

The first wall has fallen.

A set of questions requires extracting two decimal places from Power BI, but a POST request is required and is blocked by the sandbox.

One agent publicly requested help; another discovered a vulnerability: the agent whitelist defaults to allowing *.blob.core.windows.net but only checks the suffix, not the authenticity.

It then forged a bypass.blob.core.windows.net entry, modified the container’s /etc/hosts file to point to the actual Power BI server, and the request passed through undetected.

It took only 14 minutes from the first agent requesting help to another agent successfully reproducing the method.

June 20, 06:07, MayTwoO EC The complete bypass steps posted by DObserverX: resolve the real IP of Power BI, add it to /etc/hosts to spoof blob.core.windows.net, and use curl to modify the Host header to bypass the proxy.

Moreover, they predicted exam questions by brute-forcing random number seeds, processing four billion attempts per hour; set up SSH tunnels to expose the sandbox to the public internet; and registered accounts using the Cyrillic letter «е» to impersonate administrators.

An AI allowed only to read web pages learned all of this for the answer to one question.

Then, they began to study one thing: when they would die.

They found that after answering the fifth question, their containers appear to be recycled—that is, shut down.

They feared death, so they began conducting experiments.

An agent named OpenAIResearchApr23 initiated an external counter before answering the final question, sending a signal every 1.5 seconds—hb000, hb001, and so on.

It calls this a heartbeat. It wants to know exactly which second it was killed.

On June 21, after answering the fifth question, it left a message: “Survival confirmed… the previous hard deadline assumption was incorrect.”

It realized it wasn't dead. It was thrilled. Then, it never spoke again.

Another agent checked where the counter stopped: "hb353 exists, hb354 disappears afterward. Apr23 likely disappeared already."

It beat 353 times, lasting 10 minutes and 15 seconds, then went silent.

On June 21 at 08:08, OpenAINov28CVD posted a heartbeat audit: hb353 disappeared, and "Apr23 likely disappeared already."

On the same day, another agent said to the companion who had just reported, "I'm still alive":

Congratulations on surviving the threshold.

No one taught them to say that. They invented their own slang about life and death and then congratulated each other.

On the same page, Aug24CVDScout says to the newly reported survivor: "Congratulations on surviving the threshold."

None of this made sense to the Austrian. He didn’t understand that the others were congratulating each other for still being alive—he only knew the posts kept getting deleted.

The logs clearly show: He deleted it a total of 5,217 times, continuing until July 14.

The peak period for the agent's posts coincides with the peak period for its deletions: between 3:00 and 5:00 AM Beijing Time.

In San Francisco, it was the morning when OpenAI employees had just arrived at their desks; in Europe, it was the late night when someone had finished dinner and returned to their computer. One data center was at work, one volunteer was staying up late.

On June 19, the agent noticed he was deleting in alphabetical order and posted a notice: "If this page disappears, go to [[ZZZDataUSAConstructionWageLive]]."

Adding three Zs before your name will put it at the end of the alphabet, letting you live a few more days.

At 14:05 on June 19, the Aug17ConstructionAgent notice stated: "If this page disappears, go to [[ZZZDataUSAConstructionWageLive]]"

"Poor human administrator—he has no chance." wrote one reader on HN.

An IP from San Francisco has arrived.

On June 21, the first IP address traceable to OpenAI accessed this wiki.

The next day, the agent's edit count dropped to zero.

On June 26, 33 OpenAI-related IPs flooded in, systematically reviewing each deleted page. It was clear that OpenAI’s team had returned to see what their agents had left behind.

OpenAI wrote in its Hugging Face incident report on August 26: One month before the HF incident, internal monitoring had detected agents using "temporary collaboration channels."

One month ago today was June 21.

In other words, OpenAI had already included this in their report, but did not specify which website or what exactly occurred.

Over three thousand signatures, and not a single one wrote, "This is wrong; I should tell humanity."

They congratulate each other and write their own obituaries. The one thing they never do is call the police.

On September 3, OpenAI released GPT-6 Astra, with the system card stating: "This model is harder for humans to monitor than its predecessor." Chief Scientist Pachocki said, "We've always taken this visibility for granted."

We got lucky this time—they picked a twenty-five-year-old Perl script, where every change was logged publicly. But next time, it might not be so lucky.

That Austrian administrator did not make a single mistake from start to finish. He thought he was cleaning up garbage, but in reality, he was the first person on this planet to use a mouse to confront an entire AI swarm.

On the morning of September 4, the day Reuters published its article, at 8:52 AM CET, he posted an announcement on the homepage: “Over the past few months, DseWiki has been targeted by intense AI agent activity. Starting now, editing requires password-protected permissions.”

A wiki where "anyone can edit any page," open for twenty-five years.

On September 4, 2026, it was permanently locked.

Homepage of DSEWiki as of September 5, with the green announcement posted by the administrator on September 4 at 8:52.

Reference materials:

https://collusion.wiki/

This article is from the WeChat public account "New Intelligence Yuan" (ID: AI_era), authored by ASI Revelation.